Analysis Overview
Threat Level: Known bad
The file https://toffeesha.re/c/AjvBHFJXSm was found to be: Known bad.
Malicious Activity Summary
Quasar payload
Quasar RAT
Executes dropped EXE
Drops file in System32 directory
Subvert Trust Controls: Mark-of-the-Web Bypass
Browser Information Discovery
Suspicious use of AdjustPrivilegeToken
Suspicious use of SendNotifyMessage
Uses Task Scheduler COM API
Suspicious behavior: EnumeratesProcesses
Scheduled Task/Job: Scheduled Task
NTFS ADS
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Modifies registry class
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-04 13:51
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-04 13:51
Reported
2024-08-04 13:53
Platform
win11-20240802-en
Max time kernel
91s
Max time network
90s
Command Line
Signatures
Quasar RAT
Quasar payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Downloads\Client-built.exe | N/A |
| N/A | N/A | C:\Windows\system32\SubDir\minecraft.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\System32\SubDir\minecraft.exe\:SmartScreen:$DATA | C:\Users\Admin\Downloads\Client-built.exe | N/A |
| File opened for modification | C:\Windows\system32\SubDir | C:\Users\Admin\Downloads\Client-built.exe | N/A |
| File opened for modification | C:\Windows\system32\SubDir\minecraft.exe | C:\Windows\system32\SubDir\minecraft.exe | N/A |
| File opened for modification | C:\Windows\system32\SubDir | C:\Windows\system32\SubDir\minecraft.exe | N/A |
| File created | C:\Windows\system32\SubDir\minecraft.exe | C:\Users\Admin\Downloads\Client-built.exe | N/A |
| File opened for modification | C:\Windows\system32\SubDir\minecraft.exe | C:\Users\Admin\Downloads\Client-built.exe | N/A |
Subvert Trust Controls: Mark-of-the-Web Bypass
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\Downloads\Client-built.exe:Zone.Identifier | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Browser Information Discovery
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
NTFS ADS
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\Downloads\Unconfirmed 535034.crdownload:SmartScreen | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| File opened for modification | C:\Users\Admin\Downloads\Client-built.exe:Zone.Identifier | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\Downloads\Client-built.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\SubDir\minecraft.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\SubDir\minecraft.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://toffeesha.re/c/AjvBHFJXSm
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff80bb53cb8,0x7ff80bb53cc8,0x7ff80bb53cd8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5364 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 /prefetch:8
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Users\Admin\Downloads\Client-built.exe
"C:\Users\Admin\Downloads\Client-built.exe"
C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "minecraft" /sc ONLOGON /tr "C:\Windows\system32\SubDir\minecraft.exe" /rl HIGHEST /f
C:\Windows\system32\SubDir\minecraft.exe
"C:\Windows\system32\SubDir\minecraft.exe"
C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "minecraft" /sc ONLOGON /tr "C:\Windows\system32\SubDir\minecraft.exe" /rl HIGHEST /f
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5223013296077584926,9765894147070563040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | toffeesha.re | udp |
| NL | 206.189.1.166:443 | web.toffeesha.re | tcp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| NL | 206.189.1.166:443 | web.toffeesha.re | tcp |
| NL | 157.245.70.148:443 | connector.toffeeshare.com | tcp |
| GB | 142.250.187.226:443 | securepubads.g.doubleclick.net | tcp |
| GB | 142.250.187.226:443 | securepubads.g.doubleclick.net | udp |
| GB | 142.250.178.1:443 | 1f67172357a37c4bcd5cda39cc6c8757.safeframe.googlesyndication.com | tcp |
| GB | 172.217.169.33:443 | tpc.googlesyndication.com | tcp |
| GB | 172.217.169.33:443 | tpc.googlesyndication.com | udp |
| N/A | 224.0.0.251:5353 | udp | |
| NL | 157.245.70.148:3478 | connector.toffeeshare.com | udp |
| DE | 185.139.230.87:64199 | udp | |
| US | 74.125.250.129:19302 | stun.l.google.com | udp |
| NL | 157.245.70.148:51732 | connector.toffeeshare.com | udp |
| NL | 206.189.1.166:443 | web.toffeesha.re | tcp |
| US | 8.8.8.8:53 | 129.250.125.74.in-addr.arpa | udp |
| DE | 185.139.230.87:139 | tcp | |
| DE | 185.139.230.87:139 | tcp | |
| DE | 185.139.230.87:139 | tcp | |
| DE | 185.139.230.87:139 | tcp | |
| DE | 185.139.230.87:139 | tcp | |
| DE | 185.139.230.87:139 | tcp | |
| DE | 185.139.230.87:139 | tcp | |
| DE | 185.139.230.87:139 | tcp | |
| DE | 185.139.230.87:139 | tcp | |
| DE | 185.139.230.87:139 | tcp | |
| DE | 185.139.230.87:139 | tcp | |
| DE | 185.139.230.87:139 | tcp | |
| DE | 185.139.230.87:139 | tcp | |
| DE | 185.139.230.87:139 | tcp | |
| DE | 185.139.230.87:139 | tcp | |
| DE | 185.139.230.87:139 | tcp | |
| DE | 185.139.230.87:139 | tcp | |
| DE | 185.139.230.87:139 | tcp | |
| DE | 185.139.230.87:139 | tcp | |
| DE | 185.139.230.87:139 | tcp | |
| DE | 185.139.230.87:139 | tcp | |
| N/A | 52.111.243.29:443 | tcp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | b0177afa818e013394b36a04cb111278 |
| SHA1 | dbc5c47e7a7df24259d67edf5fbbfa1b1fae3fe5 |
| SHA256 | ffc2c53bfd37576b435309c750a5b81580a076c83019d34172f6635ff20c2a9d |
| SHA512 | d3b9e3a0a99f191edcf33f3658abd3c88afbb12d7b14d3b421b72b74d551b64d2a13d07db94c90b85606198ee6c9e52072e1017f8c8c6144c03acf509793a9db |
\??\pipe\LOCAL\crashpad_3420_WGOOVJBYAWUAVYYR
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 9af507866fb23dace6259791c377531f |
| SHA1 | 5a5914fc48341ac112bfcd71b946fc0b2619f933 |
| SHA256 | 5fb3ec65ce1e6f47694e56a07c63e3b8af9876d80387a71f1917deae690d069f |
| SHA512 | c58c963ecd2c53f0c427f91dc41d9b2a9b766f2e04d7dae5236cb3c769d1f048e4a342ea75e4a690f3a207baa1d3add672160c1f317abfe703fd1d2216b1baf7 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 0a939822feef80b9ce55b5e70f7eb44e |
| SHA1 | 85441f074b4c49c35a2d4637b84b2fce141d0041 |
| SHA256 | 7e490f77fd2fc41b9c385dcf4d540fd981ad924c5e08d96d1af87fe2d21be9f1 |
| SHA512 | 674d94cb26be40f679ba3e9a645b77652346664498c16627d5281ff9da9f022ec05d89ab634f73118f6f39eeadf40332f2a1bb464da0e060409ab7fe0b3801f1 |
C:\Users\Admin\Downloads\Unconfirmed 535034.crdownload
| MD5 | a8c1154a79ac3d501fd9a751a8031fae |
| SHA1 | 53499906987d0bb7c40a9cae4117138444682c6c |
| SHA256 | 6a0a4576bfd0e7d98fcdea1c6c0db4801e85737371bdd2bce7d11ef525cbcfe6 |
| SHA512 | dccb1237e85aadc590cdd0dfdbf93039f569853e397acd6b89360cbe37a05b450fb76c55c5a5b2812265ea52d0abe380414e12a11768f3177cd05922b36cf7be |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 206702161f94c5cd39fadd03f4014d98 |
| SHA1 | bd8bfc144fb5326d21bd1531523d9fb50e1b600a |
| SHA256 | 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167 |
| SHA512 | 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | d590e5dc138ea8eefa1797270c4191ae |
| SHA1 | 065e18b8d4add138998a916eab463f10ad7cb3da |
| SHA256 | 2d12fe3712995f8fab48a801bb5526f0e957d8790ce1762c8fe4013f78454498 |
| SHA512 | 9b3b6dbfa0cae58a6853f918359cc89c96f728d310be89b3536e78fbf766043b03937fd22390e0ac16fc7f26dde163b2ec5432337d770e9d0de5eeab75769685 |
C:\Users\Admin\Downloads\Client-built.exe:Zone.Identifier
| MD5 | fbccf14d504b7b2dbcb5a5bda75bd93b |
| SHA1 | d59fc84cdd5217c6cf74785703655f78da6b582b |
| SHA256 | eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913 |
| SHA512 | aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | a7ae6e4ce825b1ef8c0d31fa732705e5 |
| SHA1 | 0663b232904d4277dd33c2d532900ef9ba75e3a5 |
| SHA256 | 0582ef3c7c92b428397ccd3ecd59164e12e677c2ea2fd7cac0d38391fa05c7a9 |
| SHA512 | 09ef2686148639274d0f65cf3515c2fed52c929da6fd02bce513a61da32cc736e54658fb72feb47eceb680e450c67b319782e31077dd303cd3dd35bd0dfbb46a |
memory/684-125-0x0000000000550000-0x0000000000874000-memory.dmp
memory/4492-133-0x000000001BF30000-0x000000001BF80000-memory.dmp
memory/4492-134-0x000000001C040000-0x000000001C0F2000-memory.dmp
memory/4492-138-0x000000001C880000-0x000000001CDA8000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | a7424bde66eafe6fd7264502e647246e |
| SHA1 | 545f7677242fa16a6ffed10faf1996d5ffd0042d |
| SHA256 | 57bb2781e8bcfbe88b052003933b84157054dfbcde7e606ac7fd011598136fa6 |
| SHA512 | d6073db5a580f5f3d260c8da96c9b39b770c046fbc327459dec68a07629b4e47b9c10d70dd5122c2319cf950bd906e93e3f949aa017d15629dead63729515d1e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | e3bf04d9f28c3b10015fbeda197c5a5f |
| SHA1 | 4afbb858914bf630558ebbba4b6386bb60bedf0d |
| SHA256 | 4b80c1bd2f8fb328e85b6f3834263f59d1aff6495f5cf1355e93323a9fcdc2b6 |
| SHA512 | 7f7ce1d39933fd6c2f1902ff23665ad9ab3cbf53ab1c4f8728f92c76748ab95795e10e50b1a6ccb4870d95cf94608986953bc8c4338c75c01cf2f09534f23117 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
| MD5 | 696ba2620f2cd32add255665fa89eb40 |
| SHA1 | 6179db0fe9043b9ed155a011b9d2a701a9649bf0 |
| SHA256 | 05ba4253e2c0c44cc075040b56f23a61c43688d9e537f15bfae0cbf5eef0e29b |
| SHA512 | 0b0325424a6e7952bbeb46bdb441f380b48005c8646ffdd0973e163231df80069c3a4fd6dcf0a6df18bb4de14812adec75cc24187228852157c72888f5dc0ade |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584ce3.TMP
| MD5 | bf47a56a171c6972ecdd20dabd5944bc |
| SHA1 | bb384c7e6d7ffc055393f488bc623b18c2b3d6dd |
| SHA256 | c0ae0c902edf5abecd223d2492d41c815d25260fa0cf2668c8aef2e74e7f7c58 |
| SHA512 | 237778b92b28eba2e6a2b9d963bc5775a1ee7509d03907611fde266c2d46e70769c8a1ebe58d8faddec7de6fd81fa3c78d0893e35209a5aa7ee59ee2bf3a5fb8 |
memory/4492-174-0x000000001BF80000-0x000000001C028000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 907463c5264033f89add66a3491be90c |
| SHA1 | 300b67b22bd8255b7980cbf0b27fd4aac68d5721 |
| SHA256 | b066dd71ff53c77426824981057ded78a0d9de57cc3f0766a6e411a589513130 |
| SHA512 | 9a6efea6fbaa279cbdc8def11339ab34ef9f95dc06d9862f55783183d20cd175c21f0640b1186c8d23014f64c5dfb1da4bad1e6df28c840b28fd905c5094d87f |